However, there are still some major challenges to build a subgraph matching system for streaming graphs. Most of the existing works follow filtering-enumeration technique [1]}, where per-query metadata, generally referred as an index, is used to store the candidate matches of the query graph and provide better access locality for backtracking processes [2]}, [3]}, [4]}, [5]}, [6]}, [7]}, [8]}. Later, all the embeddings are listed and verified by traversing the index. However, these works are not suitable for streaming graph as updating index for single edge insertion or deletion can take up to \(\mathcal {O}{(|V|)}\) , where \(V\)  is the number of nodes on the data graph. Recomputing the index every time the graph gets updated incurs huge redundant computation. Recent works [9]}, [10]} present data-graph centric index structures to improve the updating and incremental subgraph matching. However, there is still a large gap to be filled in order to support a real-time subgraph matching (1) The multiple edges between two endpoints(e.g., NetFlow events at different time) are treated as one entry in their index and thus loses the temporal context of the system behavior. (2) While graphs are streamed, the index is maintained entirely in the memory. Since index size is much bigger than graph itself, it is not suited for long running streams with large data volume. (3) The edge insertions and deletions are processed in strictly sequential manners. While there is room for parallelization even for 1-edge insertion or deletion, it fails to sufficiently utilize the computing power of multi-core machines.
